Facilities staff store digital building plans in an unsanctioned consumer cloud drive that IT cannot see or govern. Which control approach best restores visibility and policy enforcement over that shadow SaaS use?

When facilities staff park digital building plans in a consumer cloud drive, the city loses asset inventory, access control, encryption governance, and e-discovery—classic shadow SaaS. A Cloud Access Security Broker (CASB) restores visibility and enforcement by discovering unsanctioned services (via logs, API connectors, or inline proxies), classifying data in those stores, and applying access and data policies such as blocking personal drives for plan repositories, forcing sanctioned storage, or encrypting sensitive objects under city keys. A blanket citywide cloud ban without an approved alternative or discovery method drives work further underground and still leaves existing shadow stores ungoverned. Annual paper attestations create compliance paperwork without proving current storage locations or stopping tomorrow’s upload. Moving plans to an unencrypted USB in a shared drawer trades one uncontrolled repository for another with weaker custody and no remote wipe. Exam caveat: CASB is the CISSP-aligned answer for discovering and controlling shadow cloud use; bans and attestations alone are insufficient governance. Know CASB versus SSE/SASE packaging, but the core need remains visibility plus policy on cloud data paths. Operational check: deploy CASB discovery against proxy and identity logs, inventory unsanctioned storage holding facility plans, migrate content to an approved repository, enforce block or coach policies on consumer drives, and re-scan periodically so new shadow services surface before the next renovation cycle.